OpenID Connect

JWT (JSON Web Token) is an open standard (RFC 7519).

OpenID Connect is an identity layer built on top of OAuth 2.0 that introduces an ID Token, typically in JWT format, for proving user identity to the client.

OAuth 2.0专门处理授权委托，OpenID Connect在OAuth 2.0之上叠加身份验证层，SAML多用于企业联邦身份场景

Common SSO implementation protocols include SAML 2.0, OAuth 2.0, and OpenID Connect (OIDC).

In OIDC, email is merely an attribute declared by the provider and may be unverified; email_verified indicates that the provider has confirmed that the email is controlled by the current user, while sub or provider_user_id is the stable and hard-to-forge identity identifier.

OIDC is an authentication protocol based on OAuth 2.0 that, in CI/CD contexts, can request temporary credentials typically valid for 15 minutes to 1 hour; these credentials are bound to a specific repository, branch, and workflow, expire after use, and are recommended by both AWS and GitHub as a production-grade credential management approach.

JalOS's GitHub Actions workflow obtains short-lived AWS temporary credentials via OpenID Connect (OIDC) rather than storing long-term access keys.

OAuth 2.0 and OpenID Connect (OIDC) are based on JSON and JWT, have a smaller protocol surface area, a clearer binding relationship between signatures and data, and a smaller attack surface than SAML.

The white paper advocates extending mature protocols such as OAuth 2.0 and OpenID Connect to adapt to agent scenarios, rather than overturning existing standards.

The identity federation space experienced competition among SAML, OpenID, and WS-Federation, with OpenID Connect ultimately prevailing in consumer internet scenarios and SAML continuing in enterprise scenarios.

In recent years, the industry has increasingly favored adopting JSON-based OAuth 2.0 and OpenID Connect (OIDC) as identity authentication and authorization solutions.

Standard protocols such as OIDC do not impose mandatory specifications for multi-tenant scenarios, and implementations vary considerably across platforms.

Both OAuth and OpenID Connect assume that the MCP client has already been registered with the server or authorization server.

Sigstore is an open-source project backed by the Linux Foundation, designed to provide a keyless signing mechanism for software packages based on OpenID Connect.

Adopting a configuration-driven design allows new identity providers to be added without modifying core code, and configuration files should include endpoint URLs, signing algorithms, required scopes, field mapping rules, and so on.

In multi-provider scenarios, independent integration test cases should be established for each identity provider, covering edge cases such as token refresh, session expiration, and network timeouts.

The differentiated implementations of identity providers are unlikely to be eliminated in the short term, reflecting the evolution of the technical ecosystem and vendors' commercial strategy considerations.

Despite all identity providers claiming to comply with OIDC specifications, significant differences exist in actual implementations.

The OIDC specification leaves room for interpretation on certain details, and different providers interpret them differently based on their own technical architecture and security considerations.

Different providers have varying lifecycle management strategies for access tokens and refresh tokens, with some using short-lived tokens with automatic refresh and others favoring long-lived tokens.